feat: SeaweedFS 替代 MinIO，Authentik ForwardAuth，多服务升级

新增:
- SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site)
- Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例)
- ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证
- gpu-exporter.py 监控脚本

升级:
- Traefik v3.6 → v3.7
- Authentik 固定版本 2026.5.0 + trusted proxy CIDR
- HedgeDoc PG 11 → 16，添加 OIDC 认证
- Homepage 添加 OIDC 认证

安全:
- Outpost token 迁移至 .env 引用（不再硬编码）
- .gitignore 扩展覆盖数据/缓存/旧 MinIO
- security.toml 清理注释掉的旧密钥

移除:
- MinIO（已全部迁移至 SeaweedFS）

uptime-kuma/compose.yml

@@ -17,6 +17,12 @@ services:
       - "traefik.http.routers.uptime.rule=Host(`uptime.xiteng.site`)"
       - "traefik.http.services.uptime.loadbalancer.server.port=3001"
       - "traefik.http.routers.uptime.entrypoints=websecure"
+      # ForwardAuth via Authentik Outpost
+      - "traefik.http.middlewares.authentik-auth.forwardauth.address=http://authentik-outpost:9000/outpost.goauthentik.io/auth/traefik"
+      - "traefik.http.middlewares.authentik-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.authentik-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name"
+      - "traefik.http.routers.uptime.middlewares=authentik-auth"
+      - "traefik.http.routers.uptime-http.middlewares=authentik-auth"
       - "traefik.http.routers.uptime-http.rule=Host(`uptime.xiteng.site`)"
       - "traefik.http.routers.uptime-http.service=uptime"
       - "traefik.http.routers.uptime-http.entrypoints=web"
@@ -25,7 +31,7 @@ services:
       - "homepage.group=我的服务"
       - "homepage.name=Uptime Kuma"
       - "homepage.icon=uptime-kuma"
-      - "homepage.href=https://status.xiteng.site"
+      - "homepage.href=https://uptime.xiteng.site"
       - "homepage.description=网站监控工具"
     networks:
       - homelab_net